fixes #2273 - authorization over environment model